mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
7bd28e4357
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2304 21ef857c-d57f-4fe0-8362-d861dc6d29cd
758 lines
37 KiB
HTML
758 lines
37 KiB
HTML
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
|
|
<html>
|
|
<head>
|
|
<title>Process Hacker Help</title>
|
|
<style type="text/css">
|
|
body {
|
|
font-family: "Cambria", "Times New Roman", Serif;
|
|
font-size: 11pt;
|
|
}
|
|
|
|
dt {
|
|
font-weight: bold;
|
|
}
|
|
|
|
pre {
|
|
font-size: 10pt;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<p><em><strong>Process Hacker</strong></em></p>
|
|
|
|
<h1 id="intro">Introduction</h1>
|
|
<p>Process Hacker is a tool to view and manipulate processes and services. It can display process' threads,
|
|
modules, memory regions and handles, search through process memory, and read/write memory using
|
|
a built-in hex editor.</p>
|
|
|
|
<h2>System Requirements</h2>
|
|
<ul>
|
|
<li>Microsoft Windows XP SP2, Vista or 7 (Windows XP SP3 and Windows Vista SP1 required for certain features)</li>
|
|
<li>.NET Framework 2.0</li>
|
|
</ul>
|
|
|
|
<h2>Configuration Files</h2>
|
|
<p>On Windows Vista, the configuration files for Process Hacker are stored in
|
|
<code>AppData\Local\wj32</code>. On Windows XP, they are stored in
|
|
<code>Local Settings\Application Data\wj32</code>.</p>
|
|
|
|
<h2>Command Line Options</h2>
|
|
<dl>
|
|
<dt>-a</dt>
|
|
<dd>Aggressive mode. Attempts to unhook all system call stubs and hooks certain system calls
|
|
to use KProcessHacker.</dd>
|
|
<dt>-e</dt>
|
|
<dd>Enables extended command line processing (not documented at the present time).</dd>
|
|
<dt>-elevate</dt>
|
|
<dd>Starts Process Hacker elevated.</dd>
|
|
<dt>-h, -help, -?</dt>
|
|
<dd>Shows a list of available command line options.</dd>
|
|
<dt>-installkph</dt>
|
|
<dd>Installs the KProcessHacker service.</dd>
|
|
<dt>-ip pid</dt>
|
|
<dd>Opens process properties for the specified process after all other loading has completed.</dd>
|
|
<dt>-m</dt>
|
|
<dd>Starts Process Hacker hidden, regardless of any settings.</dd>
|
|
<dt>-nokph</dt>
|
|
<dd>Disables KProcessHacker.</dd>
|
|
<dt>-o [-hwnd hWnd] [-rect x,y,width,height]</dt>
|
|
<dd>Opens Process Hacker options without the main window. Note that the width and height parts of
|
|
the rectangle parameter are ignored.</dd>
|
|
<dt>-pw pid</dt>
|
|
<dd>Opens process properties for the specified process without the main window.</dd>
|
|
<dt>-pt pid</dt>
|
|
<dd>Opens token properties for the token of the specified process without the main window.</dd>
|
|
<dt>-t tab</dt>
|
|
<dd>Opens the specified tab at startup. Use 0 for Processes, 1 for Services and 2 for Network.</dd>
|
|
<dt>-uninstallkph</dt>
|
|
<dd>Uninstalls the KProcessHacker service.</dd>
|
|
<dt>-v</dt>
|
|
<dd>Starts Process Hacker visible, regardless of any settings.</dd>
|
|
</dl>
|
|
|
|
<h1 id="options">Options</h1>
|
|
<p>Process Hacker's options are accessible from the <strong>Options</strong> menu item
|
|
in the <strong>Hacker</strong> menu.</p>
|
|
|
|
<h2>General</h2>
|
|
<dl>
|
|
<dt>Update Interval</dt>
|
|
<dd>The amount of time in milliseconds between each <em>update</em>; i.e, when
|
|
Process Hacker looks for new, modified or removed processes, services and other objects.</dd>
|
|
|
|
<dt>Processes in icon menu</dt>
|
|
<dd>The number of processes to display in the notification icon menu.</dd>
|
|
|
|
<dt>Search Engine</dt>
|
|
<dd>This is used by the <strong>Search Online...</strong> menu item in the process and module
|
|
context menus. <code>%s</code> is replaced by the name of the selected process or module.</dd>
|
|
|
|
<dt>Require Signatures</dt>
|
|
<dd>If <strong>Verify signatures and perform additional checks</strong> is enabled, this
|
|
specifies the processes that must have a valid signature. Processes with a <em>name</em>
|
|
that is specified in this field and do not have a valid signature will be highlighted
|
|
as a <em>Packed/Dangerous Process</em> (see Higlighting options).</dd>
|
|
|
|
<dt>Max. Size Unit</dt>
|
|
<dd>Specifies the maximum unit of size; sizes which can be displayed as 1024 or less in a
|
|
smaller unit will be displayed in that smaller unit, while sizes requiring a larger unit will
|
|
use units up to the maximum unit specified here.</dd>
|
|
|
|
<dt>Hide when minimized</dt>
|
|
<dd>If enabled, Process Hacker will automatically hide itself when it is minimized. You
|
|
can double-click on the notification icon to show Process Hacker.</dd>
|
|
|
|
<dt>Hide when closed</dt>
|
|
<dd>If enabled, Process Hacker will automatically hide itself when it is closed. You
|
|
can double-click on the notification icon to show Process Hacker.</dd>
|
|
|
|
<dt>Start hidden</dt>
|
|
<dd>If enabled, Process Hacker will start hidden. You can double-click on the notification
|
|
icon to show Process Hacker.</dd>
|
|
|
|
<dt>Allow only one instance</dt>
|
|
<dd>If enabled, Process Hacker will allow only one instance of itself. Any attempts to start
|
|
a new instance will show the existing instance.</dd>
|
|
|
|
<dt>Float child windows</dt>
|
|
<dd>If enabled, child windows such as process properties and the memory editor will float
|
|
above the main Process Hacker window.</dd>
|
|
|
|
<dt>Scroll down the process tree at startup</dt>
|
|
<dd>If enabled, Process Hacker will scroll down the process tree to the first instance of
|
|
explorer.exe running as the current user at startup.</dd>
|
|
|
|
<dt>Show user/group domains</dt>
|
|
<dd>If enabled, Process Hacker will show the domain of users and groups: <code>user</code>
|
|
would be shown as <code>machine-name\user</code>.</dd>
|
|
</dl>
|
|
|
|
<h2>Advanced</h2>
|
|
<dl>
|
|
<dt>Enable kernel-mode driver</dt>
|
|
<dd>Some handles cannot be displayed by a user-mode program like Process Hacker; this
|
|
option enables <em>KProcessHacker</em> which allows Process Hacker
|
|
to display all handles and bypass rootkits/security software. If enabled, it will be
|
|
loaded the next time Process Hacker is started.</dd>
|
|
|
|
<dt>Enable experimental features</dt>
|
|
<dd>Enables experimental features such as process protection.</dd>
|
|
|
|
<dt>Verify signatures and perform additional checks</dt>
|
|
<dd>This option affects newly created processes, and controls whether Process Hacker will
|
|
attempt to verify the digital signatures of processes and detect packed images.</dd>
|
|
|
|
<dt>Replace Task Manager with Process Hacker</dt>
|
|
<dd>If enabled, any attempt to start Task Manager will start Process Hacker instead.</dd>
|
|
|
|
<dt>Warn about potentially dangerous actions</dt>
|
|
<dd>If disabled, Process Hacker will not show confirmation prompts for most actions.</dd>
|
|
|
|
<dt>Hide handles with no name</dt>
|
|
<dd>If enabled, unnamed handles will be hidden by default. This can be changed in each
|
|
process properties window.</dd>
|
|
|
|
<dt>Hide Process Hacker network connections</dt>
|
|
<dd>If enabled, network connections made by Process Hacker will be hidden in the network
|
|
connections list.</dd>
|
|
|
|
<dt>Elevation</dt>
|
|
<dd>Controls how Process Hacker will prompt for elevation in operations where the user
|
|
does not have required permissions.</dd>
|
|
|
|
<dt>Max. Sample History</dt>
|
|
<dd>Specifies the maximum number of performance-related samples to be retained. This includes
|
|
CPU, I/O and memory usage data for the system and all processes.</dd>
|
|
</dl>
|
|
|
|
<h2>Highlighting</h2>
|
|
<dl>
|
|
<dt>Highlighting Duration</dt>
|
|
<dd>This specifies the amount of time for which new and removed objects (processes, threads and services)
|
|
are highlighted in a different color.</dd>
|
|
|
|
<dt>New Objects</dt>
|
|
<dd>New processes, services, threads, modules, memory regions, and handles.</dd>
|
|
|
|
<dt>Removed Objects</dt>
|
|
<dd>Terminated/deleted processes, services, threads, modules, memory regions and
|
|
handles.</dd>
|
|
|
|
<dt>Own Processes</dt>
|
|
<dd>Processes running under the same user account as Process Hacker.</dd>
|
|
|
|
<dt>System Processes</dt>
|
|
<dd>Processes running under the SYSTEM user account.</dd>
|
|
|
|
<dt>Service Processes</dt>
|
|
<dd>Processes hosting one or more services.</dd>
|
|
|
|
<dt>Debugged Processes</dt>
|
|
<dd>Processes currently being debugged.</dd>
|
|
|
|
<dt>Elevated Processes</dt>
|
|
<dd>Processes running with full privileges on a computer with
|
|
User Account Control (UAC) enabled.</dd>
|
|
|
|
<dt>Job Processes</dt>
|
|
<dd>Processes associated with a job object.</dd>
|
|
|
|
<dt>.NET Processes and DLLs</dt>
|
|
<dd>Managed (.NET) processes and DLLs/modules.</dd>
|
|
|
|
<dt>POSIX Processes</dt>
|
|
<dd>POSIX subsystem processes (also known as Subsystem for UNIX-based Applications).</dd>
|
|
|
|
<dt>Packed/Dangerous Processes</dt>
|
|
<dd>Packed images and images with invalid signatures. These processes
|
|
are often, but not always malicious - normal executables are often packed to reduce their
|
|
size.</dd>
|
|
|
|
<dt>Suspended Threads</dt>
|
|
<dd>Threads which have been suspended.</dd>
|
|
|
|
<dt>GUI Threads</dt>
|
|
<dd>Threads which have made at least one GUI-related system call.</dd>
|
|
|
|
<dt>Relocated DLLs</dt>
|
|
<dd>DLLs which were not loaded at their preferred base address.</dd>
|
|
|
|
<dt>Protected Handles</dt>
|
|
<dd>Handles which are protected from being closed.</dd>
|
|
|
|
<dt>Inherit Handles</dt>
|
|
<dd>Handles which will be inherited by child processes.</dd>
|
|
</dl>
|
|
|
|
<h2>Plotting</h2>
|
|
<dl>
|
|
<dt>Use Anti-aliasing</dt>
|
|
<dd>If enabled, Process Hacker will draw graphs with anti-aliasing. This will
|
|
usually consume much more system resources than normal.</dd>
|
|
|
|
<dt>Step</dt>
|
|
<dd>This option controls the distance in pixels between each data point.</dd>
|
|
</dl>
|
|
|
|
<h2>Symbols</h2>
|
|
<dl>
|
|
<dt>Dbghelp.dll path</dt>
|
|
<dd>Select the path to the most recent version of dbghelp.dll you have
|
|
installed on your computer. If you do not have the latest version, go to
|
|
<code>http://www.microsoft.com/whdc/devtools/debugging/default.mspx</code> and
|
|
download Debugging Tools for Windows.</dd>
|
|
|
|
<dt>Search path</dt>
|
|
<dd>Type in a symbol server path. Most users will want to use the following:
|
|
<code>SRV*<strong>C:\Users\USERNAME\Symbols</strong>*http://msdl.microsoft.com/download/symbols</code>.
|
|
This will have any needed symbols downloaded from Microsoft's symbol server to
|
|
the specified directory (in bold).</dd>
|
|
|
|
<dt>Undecorate symbols</dt>
|
|
<dd>If enabled, C++ symbol names will be undecorated (unmangled). This is most
|
|
useful for methods with complex signatures.</dd>
|
|
</dl>
|
|
|
|
<h1 id="numberinput">Number Input</h1>
|
|
<p>Process Hacker supports the input of numbers in various bases (including some non-standard
|
|
extensions). This is allowed in: Get Function Address, Change Memory Protection, the Go To
|
|
box in Read/Write Memory, and the insertion of numbers through the <strong>Utilities</strong>
|
|
button.</p>
|
|
<p>A number is assumed to be in base 10 unless:</p>
|
|
<ul>
|
|
<li>It starts with <code>0</code> (zero) - octal (base 8)</li>
|
|
<li>It starts with <code>0x</code> - hexadecimal (base 16)</li>
|
|
<li>It starts with <code>b</code> - binary (base 2)</li>
|
|
<li>It starts with <code>t</code> - ternary (base 3)</li>
|
|
<li>It starts with <code>q</code> - quaternary (base 4)</li>
|
|
<li>It starts with <code>w</code> - base 12</li>
|
|
<li>It starts with <code>r</code> - base 32</li>
|
|
</ul>
|
|
|
|
<h1 id="proctree">Process Tree</h1>
|
|
<p>The process tree displays processes running on the system as a tree; processes started by a
|
|
particular parent process are shown indented below it. Processes with a non-existent parent
|
|
(where its parent has terminated) are shown on the far left. You can manipulate processes by
|
|
right-clicking on them, and you can show detailed properties for a process by double-clicking
|
|
it or selecting the "Properties..." menu item.</p>
|
|
|
|
<p>You can sort by the various columns by clicking on them - the tree view will temporarily
|
|
become a flat list. You can click the same column again to sort in the reverse order, and
|
|
once more to return to the tree view.</p>
|
|
|
|
<p>Like Process Explorer, Process Hacker shows Deferred Procedure Calls (DPCs) and Interrupts
|
|
in the process tree. The only information these "processes" show is their CPU usage.</p>
|
|
|
|
<h2>Context Menu</h2>
|
|
<p><strong>Warning:</strong> Manipulating csrss.exe, dwm.exe, lsass.exe, lsm.exe, smss.exe,
|
|
winlogon.exe or any other system processes is not recommended and may lead to system instability or
|
|
a crash.</p>
|
|
|
|
<dl>
|
|
<dt>Terminate Process(es)</dt>
|
|
<dd>Terminates the selected process(es). If KProcessHacker is enabled, Process Hacker
|
|
will, except under extraordinary circumstances, be able to terminate any process,
|
|
including ones protected by rootkits or security software.</dd>
|
|
|
|
<dt>Terminate Process Tree</dt>
|
|
<dd>Terminates the selected process and its descendants.</dd>
|
|
|
|
<dt>Suspend Process(es)</dt>
|
|
<dd>Suspends the selected process(es). If KProcessHacker is enabled and running on
|
|
Windows Vista, Process Hacker will be able to suspend any process, including ones
|
|
protected by rootkits or security software.</dd>
|
|
|
|
<dt>Resume Process(es)</dt>
|
|
<dd>Resumes the selected process(es). If KProcessHacker is enabled and running on
|
|
Windows Vista, Process Hacker will be able to resume any process, including ones
|
|
protected by rootkits or security software.</dd>
|
|
|
|
<dt>Restart</dt>
|
|
<dd>Restarts the selected process with the same command line arguments and working
|
|
directory.</dd>
|
|
|
|
<dt>Reduce Working Set</dt>
|
|
<dd>Empties the selected process(es)' working set(s).
|
|
This is a safe function; the process will eventually reclaim most of its working set.</dd>
|
|
|
|
<dt>Virtualization</dt>
|
|
<dd>Allows you to enable or disable virtualization for the selected process, if allowed.</dd>
|
|
|
|
<dt>Affinity...</dt>
|
|
<dd>Allows you to view and modify the process' CPU affinity (the CPUs on which it is allowed
|
|
to run).</dd>
|
|
|
|
<dt>Create Dump File...</dt>
|
|
<dd>Allows you to create a crash dump file for the process. This operation does not actually
|
|
cause the process to crash or terminate.</dd>
|
|
|
|
<dt>Terminator...</dt>
|
|
<dd>A tool which tries to terminate the selected process using many different techniques.</dd>
|
|
|
|
<dt>Detach from Debugger</dt>
|
|
<dd>Detaches the process from any debugger. This will cause any attached debuggers to stop working.</dd>
|
|
|
|
<dt>Heaps...</dt>
|
|
<dd>Shows the heaps created by the process. Note that this action causes a temporary thread
|
|
to be created in the process and should be used with caution.</dd>
|
|
|
|
<dt>Inject DLL...</dt>
|
|
<dd>Allows you to select a DLL file (or any other PE image) that will be injected into
|
|
the selected process. This option is only available for processes running in the same
|
|
session as Process Hacker (usually processes in the same user account).</dd>
|
|
|
|
<dt>Priority</dt>
|
|
<dd>Sets the process's priority - Real Time, High, Above Normal, Normal, Below Normal, Idle.
|
|
This option is not available when multiple processes are selected.</dd>
|
|
|
|
<dt>Run As</dt>
|
|
<dd>These tools require <code>Assistant.exe</code> (distributed with Process Hacker) to be in the same directory
|
|
as <code>ProcessHacker.exe</code>.<br />
|
|
<strong>Launch As User...</strong> - This allows you to run the selected process as another user.<br />
|
|
<strong>Launch As This User...</strong> - This allows you to run a program under the selected process' user. This
|
|
is useful when you want to start a program as another user but you do not have that user's password.</dd>
|
|
|
|
<dt>Search Online...</dt>
|
|
<dd>Opens the default web browser with the search engine specified in Process Hacker's options.</dd>
|
|
|
|
<dt>Re-analyze</dt>
|
|
<dd>Re-examines the process to determine if it is signed, packed, or a .NET process.</dd>
|
|
|
|
<dt>Select All</dt>
|
|
<dd>Selects all items in the list.</dd>
|
|
</dl>
|
|
|
|
<h2>Terminator tests</h2>
|
|
<dl>
|
|
<dt>TP1</dt>
|
|
<dd>Terminates the process using the NtTerminateProcess function.</dd>
|
|
|
|
<dt>TP2</dt>
|
|
<dd>Uses the RtlCreateUserThread function to create a thread in the process which calls
|
|
ExitProcess, terminating the process. On Vista and above, the thread calls
|
|
RtlExitUserProcess.</dd>
|
|
|
|
<dt>TT1</dt>
|
|
<dd>Terminates the process' threads by using the NtTerminateThread function.</dd>
|
|
|
|
<dt>TT2</dt>
|
|
<dd>Sets the contexts of the process' threads to point to the ExitProcess function. The
|
|
process will be terminated when one of the threads are context switched to.</dd>
|
|
|
|
<dt>TP1a</dt>
|
|
<dd>(Vista only.) Uses NtGetNextProcess to open a handle to the process and terminate it
|
|
using NtTerminateProcess.</dd>
|
|
|
|
<dt>TT1a</dt>
|
|
<dd>(Vista only.) Uses NtGetNextThread to open a handle to each of the process' threads and
|
|
terminates them using NtTerminateThread.</dd>
|
|
|
|
<dt>CH1</dt>
|
|
<dd>Uses NtDuplicateObject to close the process' handles. This method works best for
|
|
complex programs.</dd>
|
|
|
|
<dt>TJ1</dt>
|
|
<dd>Creates a job, assigns the process to it, and terminates the job, terminating the process.</dd>
|
|
|
|
<dt>TD1</dt>
|
|
<dd>Creates a debug object, assigns the process to it, and closes the debug object,
|
|
terminating the process.</dd>
|
|
|
|
<dt>TP3</dt>
|
|
<dd>Uses the internal kernel-mode function PsTerminateProcess to terminate the process.</dd>
|
|
|
|
<dt>TT3</dt>
|
|
<dd>Uses the internal kernel-mode function PspTerminateThreadByPointer to terminate the process'
|
|
threads.</dd>
|
|
|
|
<dt>TT4</dt>
|
|
<dd>Queues a kernel-mode special asynchronous procedure calls (APCs) to each of the process' threads.
|
|
This APC calls PspTerminateThreadByPointer to directly terminate the threads. This method will
|
|
terminate threads hanging due to kernel-mode code, but the system may crash or freeze because
|
|
kernel-mode code is not given the chance to release any resources. <strong>Use this option with
|
|
extreme caution.</strong></dd>
|
|
|
|
<dt>M1</dt>
|
|
<dd>Uses WriteProcessMemory to write random data to the process' memory, crashing the process.</dd>
|
|
|
|
<dt>M2</dt>
|
|
<dd>Uses VirtualProtectEx to prevent the process' pages from being used, crashing the process.</dd>
|
|
</dl>
|
|
</h2>
|
|
|
|
<h1 id="procprops">Process Properties</h1>
|
|
<dl>
|
|
<dt>General</dt>
|
|
<dd>Displays basic information about the process and its image file. You can also view the
|
|
process' PEB contents, view/change its DEP status (requires Windows XP SP3 or higher, and
|
|
changing DEP status uses remote thread injection), and protect/unprotect it (requires
|
|
Windows Vista).</dd>
|
|
|
|
<dt>Statistics</dt>
|
|
<dd>Displays statistics and performance information.</dd>
|
|
|
|
<dt>Performance</dt>
|
|
<dd>Displays three graphs relating to the process' performance - CPU Usage,
|
|
Memory Usage, and I/O activity. You can hover your mouse over the graphs to view details.</dd>
|
|
|
|
<dt>Threads</dt>
|
|
<dd>Displays the process' threads, including their symbolic start addresses. You can click on
|
|
a thread to view more information, or double-click a thread to view its call stack.</dd>
|
|
|
|
<dt>Token</dt>
|
|
<dd>Displays the process' primary token. On Windows Vista with UAC enabled, you can also
|
|
click on the <strong>Linked Token...</strong> button to view the token associated with
|
|
the process' token. You can also enable and disable privileges.</dd>
|
|
|
|
<dt>Modules</dt>
|
|
<dd>Displays the modules loaded by the process. Right-click a module for more options.</dd>
|
|
|
|
<dt>Memory</dt>
|
|
<dd>Displays the process' virtual memory regions. Double-click a memory region to
|
|
read/write its contents, and right-click a memory region to perform other actions. You can
|
|
also search memory using the search button (see below).</dd>
|
|
|
|
<dt>Environment</dt>
|
|
<dd>Displays the process' environment variables.</dd>
|
|
|
|
<dt>Handles</dt>
|
|
<dd>Displays the process' handles - resources it has opened. You can right-click a handle and
|
|
close it.</dd>
|
|
|
|
<dt>Services</dt>
|
|
<dd>Displays services that are registered in the process.</dd>
|
|
</dl>
|
|
|
|
<h1 id="memsearch">Searching Memory</h1>
|
|
<p>Process Hacker supports searching using a literal string or regular expressions. To
|
|
perform a search, open a Properties window for a process, select the <strong>Memory</strong>
|
|
tab and select an option in the search button. A window will appear in which you can
|
|
enter the data to search for. You can also control the types of memory regions to search.</p>
|
|
|
|
<dl>
|
|
<dt>Literal Search</dt>
|
|
<dd>Allows you to enter a sequence of bytes to search for.</dd>
|
|
|
|
<dt>Regex Search</dt>
|
|
<dd>Allows you to search using regular expressions.</dd>
|
|
|
|
<dt>String Scan</dt>
|
|
<dd>Scans for strings inside the process' memory.</dd>
|
|
|
|
<dt>Heap Scan</dt>
|
|
<dd>Displays a list of heap blocks.</dd>
|
|
|
|
<dt>Struct Search</dt>
|
|
<dd>Allows you to search for addresses which match the selected struct.</dd>
|
|
</dl>
|
|
|
|
<p>In the <strong>Literal</strong> tab, there is a small button in the bottom-right
|
|
which allows you to insert data in various formats.</p>
|
|
|
|
<dl>
|
|
<dt>Insert Number</dt>
|
|
<dd>This allows you to insert numbers in various formats - 8 to 64-bit, little or big endian.</dd>
|
|
|
|
<dt>Insert String</dt>
|
|
<dd>Similarly, this allows you to insert strings in various encodings - ASCII, UTF-8 to UTF-32.
|
|
If a multiline item is selected, the prompt box will have a multiline textbox.</dd>
|
|
</dl>
|
|
|
|
<p>In the search results list, double-clicking an item will open the Memory Editor with
|
|
the search result highlighted.</p>
|
|
|
|
<h2>Sample Regex Searches</h2>
|
|
<p>All of these samples must have <strong>Ignore Case</strong> selected.</p>
|
|
|
|
<p>A valid filesystem character is <code>[ a-z0-9`~';!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]</code>
|
|
|
|
<dl>
|
|
<dt>Email address</dt>
|
|
<dd><code>[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.(au|biz|ca|com|info|net|org|uk|zh)</code></dd>
|
|
|
|
<dt>Path name</dt>
|
|
<dd><code>[A-Z]:\\([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*\\)*([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}]*)(\\)*</code></dd>
|
|
|
|
<dt>Executable file</dt>
|
|
<dd><code>([ a-z0-9`~'!@#\$%\^&\-_=+\,\.\(\)\[\]\{\}])+\.(bat|com|dll|exe)</code></dd>
|
|
|
|
<dt>URL</dt>
|
|
<dd><code>(file|ftp|http):///*[a-z0-9%\/ .\-_:\(\)\[\]]+</code></dd>
|
|
</dl>
|
|
|
|
<h1 id="results">Results Window</h1>
|
|
<p>The Results Window is displayed when searching for data, scanning for strings or
|
|
scanning for heaps. There are five buttons at the top of the window:</p>
|
|
|
|
<dl>
|
|
<dt>Refresh</dt>
|
|
<dd>This performs the search again.</dd>
|
|
|
|
<dt>Edit Search</dt>
|
|
<dd>This allows you to edit the search type and data associated with the Results Window.</dd>
|
|
|
|
<dt>Filter</dt>
|
|
<dd>This allows you to filter the search results, creating a new Results Window containing
|
|
the matching items. To filter using a numerical relation, enter the relation (for example,
|
|
greater than or equal to <code>>=</code>) followed by the number. If the filter
|
|
(<code>>=10</code>) is applied to the <strong>Length</strong> column, all items with a
|
|
length greater than or equal 10 will be displayed.</dd>
|
|
|
|
<dt>Intersect</dt>
|
|
<dd>This allows you to select another Results Window. It then creates a third Results Window
|
|
in which the search results present in both Results Windows are displayed. This allows you
|
|
to filter search results.</dd>
|
|
|
|
<dt>Save...</dt>
|
|
<dd>This allows you to save the search results to a text file.</dd>
|
|
</dl>
|
|
|
|
<h1 id="glossary">Glossary</h1>
|
|
<dl>
|
|
<dt>Affinity</dt>
|
|
<dd>The set of processors on which a thread or collection of threads (process) is allowed to
|
|
execute on.</dd>
|
|
<dt>Child Process</dt>
|
|
<dd>A new process started by an existing one.</dd>
|
|
<dt>Command Line</dt>
|
|
<dd>A <em>string</em> describing a program to start and any parameters to pass to it. Examples:
|
|
<code>C:\Windows\notepad.exe C:\Windows\win.ini</code>, <code>cmd /TF0</code></dd>
|
|
<dt>Commit</dt>
|
|
<dd>A committed page or memory region contains actual data. Compare with <em>reserve</em>.</dd>
|
|
<dt>Context Switch</dt>
|
|
<dd>The act of switching a processor to run another thread. Since processors can only run one task
|
|
at a time, context switching gives the illusion of multi-tasking.</dd>
|
|
<dt>Data Execution Prevention</dt>
|
|
<dd>The Windows implementation of NX (No eXecute) technology, designed to prevent the execution of data
|
|
regions as code. This can prevent certain types of software attacks.</dd>
|
|
<dt>Elevation (UAC)</dt>
|
|
<dd>Under UAC, a process which is elevated has full administrative rights to system resources.</dd>
|
|
<dt>Environment Variable</dt>
|
|
<dd>A variable accessible to processes describing the operating system environment. Environment variables
|
|
are normally inherited by <em>child processes</em>.</dd>
|
|
<dt>Handle</dt>
|
|
<dd>A reference to a shared operating object or resource, e.g. a handle to an event, file or process.</dd>
|
|
<dt>Heap</dt>
|
|
<dd>A process-managed structure from which memory can be allocated. Since <em>pages</em> can only be
|
|
allocated in large chunks, using a heap will reduce wastage of memory for small allocations.</dd>
|
|
<dt>Image</dt>
|
|
<dd>A "package" containing executable code.</dd>
|
|
<dt>Interrupt</dt>
|
|
<dd>An event, usually signaled by hardware, that is handled by the operating system through a
|
|
<em>interrupt handler</em>.</dd>
|
|
<dt>Kernel</dt>
|
|
<dd>A collection of code that manages system-wide resources such as I/O, processes and threads, and
|
|
security. System calls are also handled by the kernel.</dd>
|
|
<dt>Kernel-mode</dt>
|
|
<dd>A processor mode in which code can access hardware directly and access all memory. For example, when
|
|
a <em>system call</em> is made, the processor switches to kernel-mode in order to perform an action on
|
|
the requester's behalf. When the system call finishes, it switches back to user-mode and the requester
|
|
continues normal execution.</dd>
|
|
<dt>Kernel-mode thread</dt>
|
|
<dd>A thread that runs solely in kernel-mode. These are usually worker threads that carry out delayed
|
|
operating system tasks. Most kernel-mode threads are contained in the System process, but in some systems
|
|
csrss.exe also runs kernel-mode threads.</dd>
|
|
<dt>LPC</dt>
|
|
<dd>Local inter-Process Communication (or Local Procedure Call). A Windows NT mechanism which enables
|
|
processes to communicate with each other.</dd>
|
|
<dt>LUID</dt>
|
|
<dd>Locally Unique IDentifier. A value which is unique on the local system until it is rebooted.</dd>
|
|
<dt>Module</dt>
|
|
<dd>An executable image which can be loaded by processes. Through this mechanism, code and resources
|
|
may be shared.</dd>
|
|
<dt>Page</dt>
|
|
<dd>A block of memory, 4 kB in size on x86 and AMD64 processors.</dd>
|
|
<dt>PEB</dt>
|
|
<dd>Process Environment Block. The PEB contains a variety of data used by the process.</dd>
|
|
<dt>Privilege</dt>
|
|
<dd>A privilege belonging to a process. It can be enabled or disabled, and certain system calls require
|
|
the presence of specific privileges to work.</dd>
|
|
<dt>Process</dt>
|
|
<dd>A collection of <em>threads</em> along with virtual memory, <em>handles</em> and other resources.</dd>
|
|
<dt>Protection (DRM)</dt>
|
|
<dd>Process and thread protection introduced in Windows Vista, designed to enhance support for digital
|
|
restrictions management. Examples of processes protected by this mechanism include System and audiodg.exe.</dd>
|
|
<dt>Reserve</dt>
|
|
<dd>A reserved page or memory region does not contain data and has not been allocated storage in physical
|
|
memory. Reserving pages is commonly done to ensure a certain amount of contiguous address space is available
|
|
without actually allocating storage. Compare with <em>commit</em>.</dd>
|
|
<dt>Service</dt>
|
|
<dd>A operating system managed program which runs in the background. They can be in shared processes
|
|
(in svchost.exe instances), in separate processes, or drivers loaded into kernel-mode space.</dd>
|
|
<dt>SID</dt>
|
|
<dd>Security IDentifier. A unique identifier assigned to security-related objects such as users and groups.</dd>
|
|
<dt>String</dt>
|
|
<dd>A sequence of characters - text.</dd>
|
|
<dt>System Call</dt>
|
|
<dd>A request that is made by a thread to the <em>kernel</em> to perform a task on the thread's behalf. This done
|
|
because most threads run in user-mode and are unable to access hardware directly. See <em>kernel-mode</em>.</dd>
|
|
<dt>System Thread</dt>
|
|
<dd>See <em>kernel-mode thread</em>.</dd>
|
|
<dt>Thread</dt>
|
|
<dd>A unit of execution belonging to a process, running code concurrently. Most threads run in <em>user-mode</em>,
|
|
but some are <em>kernel-mode threads</em>.</dd>
|
|
<dt>User Account Control</dt>
|
|
<dd>Refers to restrictions on normal processes preventing them from modifying system-wide files and settings.
|
|
Processes which are <em>elevated</em> have full administrative access to system resources.</dd>
|
|
<dt>Virtualization (UAC)</dt>
|
|
<dd>A technology which redirects writes to the file system and registry for processes which are not
|
|
<em>elevated</em>.</dd>
|
|
<dt>Working set</dt>
|
|
<dd>The collection of <em>pages</em> recently referenced by a process. These pages are in physical
|
|
memory, while other pages may be in the pagefile.</dd>
|
|
<dt>WOW64</dt>
|
|
<dd>A technology which enables 32-bit programs to run on 64-bit Windows systems.</dd>
|
|
</dl>
|
|
|
|
<h1 id="copyright">Copyright Information</h1>
|
|
<h2>Process Hacker</h2>
|
|
<pre>
|
|
Process Hacker
|
|
|
|
Copyright (C) 2008-2009 various authors (see README.txt for the full list)
|
|
|
|
This program is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.</pre>
|
|
|
|
<h2>HexBox</h2>
|
|
<p>Process Hacker uses the HexBox component by Bernhard Elbl, licensed under the
|
|
Microsoft Public License:</p>
|
|
<pre>This license governs use of the accompanying software. If you use the software, you
|
|
accept this license. If you do not accept the license, do not use the software.
|
|
|
|
1. Definitions
|
|
The terms "reproduce," "reproduction," "derivative works," and "distribution" have the
|
|
same meaning here as under U.S. copyright law.
|
|
A "contribution" is the original software, or any additions or changes to the software.
|
|
A "contributor" is any person that distributes its contribution under this license.
|
|
"Licensed patents" are a contributor's patent claims that read directly on its contribution.
|
|
|
|
2. Grant of Rights
|
|
(A) Copyright Grant- Subject to the terms of this license, including the license conditions
|
|
and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
|
|
royalty-free copyright license to reproduce its contribution, prepare derivative works
|
|
of its contribution, and distribute its contribution or any derivative works that you
|
|
create.
|
|
(B) Patent Grant- Subject to the terms of this license, including the license conditions
|
|
and limitations in section 3, each contributor grants you a non-exclusive, worldwide,
|
|
royalty-free license under its licensed patents to make, have made, use, sell, offer
|
|
for sale, import, and/or otherwise dispose of its contribution in the software or
|
|
derivative works of the contribution in the software.
|
|
|
|
3. Conditions and Limitations
|
|
(A) No Trademark License- This license does not grant you rights to use any contributors'
|
|
name, logo, or trademarks.
|
|
(B) If you bring a patent claim against any contributor over patents that you claim are
|
|
infringed by the software, your patent license from such contributor to the software
|
|
ends automatically.
|
|
(C) If you distribute any portion of the software, you must retain all copyright, patent,
|
|
trademark, and attribution notices that are present in the software.
|
|
(D) If you distribute any portion of the software in source code form, you may do so only
|
|
under this license by including a complete copy of this license with your distribution.
|
|
If you distribute any portion of the software in compiled or object code form, you may
|
|
only do so under a license that complies with this license.
|
|
(E) The software is licensed "as-is." You bear the risk of using it. The contributors give
|
|
no express warranties, guarantees or conditions. You may have additional consumer rights
|
|
under your local laws which this license cannot change. To the extent permitted under your
|
|
local laws, the contributors exclude the implied warranties of merchantability, fitness for
|
|
a particular purpose and non-infringement.</pre>
|
|
|
|
<h2>VistaMenu and SplitButton</h2>
|
|
<p>Process Hacker uses the VistaMenu and SplitButton components by Wyatt O'Day, licensed under
|
|
the following terms:</p>
|
|
<pre>Copyright (c) 2008, wyDay
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without modification, are permitted
|
|
provided that the following conditions are met:
|
|
|
|
* Redistributions of source code must retain the above copyright notice, this list of
|
|
conditions and the following disclaimer.
|
|
* Redistributions in binary form must reproduce the above copyright notice, this list of
|
|
conditions and the following disclaimer in the documentation and/or other materials provided
|
|
with the distribution.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
|
|
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
|
|
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
|
|
IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
|
OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</pre>
|
|
|
|
<h2>LINQBridge</h2>
|
|
<p>Process Hacker uses the LINQBridge component by Joseph Albahari, licensed under the
|
|
following terms:</p>
|
|
<pre>LINQBridge Copyright (c) 2007-2008 Joseph Albahari
|
|
|
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
of this software and associated documentation files (the "Software"), to deal
|
|
in the Software without restriction, including without limitation the rights
|
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
copies of the Software, and to permit persons to whom the Software is
|
|
furnished to do so, subject to the following conditions:
|
|
|
|
The above copyright notice and this permission notice shall be included in
|
|
all copies or substantial portions of the Software.
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
THE SOFTWARE.</pre>
|
|
</body>
|
|
</html>
|